APPLICATION SECURITY CONFIGURATION (FOR SSL PINNING)

Root Check -> Ensure Step 3.1 is completed

• Open google developer console.
  Select your app then navigate to Setup-> App Integrity-> change option of Response Encryption
  In the window that appears, click Manage and download my response encryption keys and follow below steps to generate response encryption keys-
• Create a new private-public key pair. RSA key size must be 2048 bits using below command- openssl genrsa -aes128 -out your_path/private.pem 2048
  Then use your password phrase for creating private.pem and also use the same password for verifying the private.pem. Then hit the below command.
  openssl rsa -in your_path/private.pem -pubout -out your_path/public.pem
  Enter the same password which you have used while creating private.pem. These two files will now appear on your mentioned path. Then upload the public.pem file on the window which was appeared after clicking on Manage and download my response encryption keys option.Once you upload the public.pem file it will automatically download your_app_pkg_name.enc file. Then hit below command as,
  openssl rsautl -decrypt -oaep -inkey your_path/private.pem -in your_app_pkg_name.enc -out your_path/api_keys.txt
  Enter the password for private.pem. It will create api_keys.tx file on your path. It must be consist of VERIFICATION_KEY and DECRYPTION_KEY.
• Maintain this VERIFICATION_KEY and DECRYPTION_KEY in DIGX_FW_CONFIG_ALL_B table corresponding to the following keys respectively:
  PLAY_INTEGRITY_ENCRYPTION_KEY and PLAY_INTEGRITY_DECRYPTION_KEY
  An example query will be:
  update DIGX_FW_CONFIG_ALL_B set prop_value = 'YOUR_DECRYPTION_KEY' where prop_id = 'PLAY_INTEGRITY_DECRYPTION_KEY';
  update DIGX_FW_CONFIG_ALL_B set prop_value = 'YOUR_ENCRYPTION_KEY' where prop_id = 'PLAY_INTEGRITY_ENCRYPTION_KEY';
• Similarly, Obtain the same keys for authenticator app by using above step 1 and then maintain those in DIGX_FW_CONFIG_ALL_B table corresponding to the following keys respectivel:
  PLAY_INTEGRITY_ENCRYPTION_KEY_AUTHENTICATOR and PLAY_INTEGRITY_DECRYPTION_KEY_AUTHENTICATOR

• An example query will be:

• update DIGX_FW_CONFIG_ALL_B set prop_value = 'YOUR_DECRYPTION_KEY' where prop_id = 'PLAY_INTEGRITY_DECRYPTION_KEY_AUTHENTICATOR';

• update DIGX_FW_CONFIG_ALL_B set prop_value = 'YOUR_ENCRYPTION_KEY' where prop_id = 'PLAY_INTEGRITY_ENCRYPTION_KEY_AUTHENTICATOR';

• Similarly, we also have to maintain package names of Servicing and Authenticator app in the same table, i.e. DIGX_FW_CONFIG_ALL_B corresponding to the following keys respectively:
  ANDROID_SERVICING_PACKAGE and ANDROID_AUTHENTICATOR_PACKAGE
  An example query will be:
  insert into digx_fw_config_all_b (PROP_ID, CATEGORY_ID, PROP_VALUE, FACTORY_SHIPPED_FLAG, PROP_COMMENTS, SUMMARY_TEXT, CREATED_BY, CREATION_DATE, LAST_UPDATED_BY, LAST_UPDATED_DATE, OBJECT_STATUS, OBJECT_VERSION_NUMBER) values ('ANDROID_SERVICING_PACKAGE', 'mobileconfig', 'com.ofss.zigbank', 'N', '', 'Stores device id in OUD', 'ofssuser', sysdate, 'ofssuser', sysdate, 'Y', 1,);
  SSL Pinning
• Get the list of Base 64 encoded SHA256 hashed certificates' public keys of server’s valid certificates. Use below command to generate this hash for your certificate. Replace '<certificate.der>' with the path to your certificate.
  openssl x509 -inform der -in <certificate.der> -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64
• Add the hashed keys generated in point 6 to zigbank\platforms\android\customizations\src\main\res\values\app.properties.xml file in ‘certificate_public_keys’ array. Append this key to ‘sha256/’ in an <item> tag as shown below. Multiple certificate keys can be added to ‘certificate_public_keys’ array by adding them in <item> tags.
  Eg.:
  

• <string-array name="certificate_public_keys">
  <item>sha256/5kJvNEMw0KjrCAu7eXY5HZdvyCS13BbA0VJG1RSP91w=</item>
  </string-array>

• Eg. for multiple certificates (In case OAM/IDCS is used):

• <string-array name="certificate_public_keys">
  <item>sha256/5kJvNEMw0KjrCAu7eXY5HZdvyCS13BbA0VJG1RSP91w=</item>
  <item>sha256/3rgsgghoqrDegekpkkgk92Fgw1w7exyYCS1okef9Oo1w=</item>
  </string-array>
  

Back